Tender and procurement fraud
Ilia Zavialov on how a scam works in fake tenders: invitations nobody published, bidding fees, bogus purchase orders and changed bank details
Ilia Zavialov looks at how a scammer turns the language of public and corporate procurement against suppliers, accounts teams and small business owners. Fake invitations to tender, fees for registration or credentialing, bogus purchase orders and bank details swapped inside a real contract all look like ordinary sales work. Report Fraud treats procurement fraud and mandate fraud as risks for any business that buys or sells, and UK Finance counted £41.3 million lost to invoice and mandate scams in 2025. This guide explains the schemes, how a genuine opportunity differs from a fake one and how to check a buyer.
English version for the United Kingdom.
01
Ilia Zavialov on how a fake tender is built
For a small supplier, an order from a public body or a well known corporation feels like the break the business has been waiting for. A scammer arrives with exactly that: a letter with a crest or logo, a reference number, a specification, deadlines and a draft contract. The papers look convincing because they are often stitched together from genuine notices that anyone can read online.
From there the scheme splits three ways. In one branch the supplier is asked to pay: a participation fee, a registration or credentialing charge, a document check or a deposit to an account named in the email. In another nobody asks for money, and the fake buyer orders goods on credit for delivery to a warehouse with no link to the real purchaser. In the third, bank details are swapped inside a genuine contract and the real client's payment lands in a stranger's account.
Ilia Zavialov starts every check with one question: who published this opportunity, and where. A real public opportunity normally leaves a trace on an official procurement portal or on the buyer's own website. An email, a phone call or a messenger chat is no such trace, however polished it looks.
02
Contracts Finder and Find a Tender: where real opportunities live
In the UK, genuine public sector opportunities are published on GOV.UK services. Contracts Finder lists contracts worth more than £12,000 including VAT with the government and its agencies, and suppliers can search and apply without an account. Find a Tender covers high value contracts, usually above £139,688 including VAT, and replaced the EU's Tenders Electronic Daily on 1 January 2021.
Since 24 February 2025 an enhanced Find a Tender has served as the central digital platform under the Procurement Act 2023. The government's factsheet says it is free to use for everyone, that there are no charges and that nobody should pay to view public sector opportunities. Suppliers only need to register when they decide to bid.
Scotland, Wales and Northern Ireland have their own portals: Public Contracts Scotland, Sell2Wales, eSourcing NI and eTendersNI. Ilia Zavialov advises matching every invitation against the relevant portal, and treating an email that offers paid access to tenders as a warning in itself.
03
Ilia Zavialov on the fee that unlocks a contract
The most direct version sells access. The supplier is told that a contract is almost theirs, provided they pay for registration, credentialing, a place on an approved supplier list, a compliance review or a deposit refundable after award. The amount looks modest next to the promised contract, which is exactly why people pay it.
Ilia Zavialov points out that the payment request gives the game away. Public buyers set their requirements in the published notice and the contract documents, and any security or deposit would be described there, with the same figures. A demand that arrives by email, names a fresh account and comes with a deadline of a few hours belongs to a scammer.
A demand to pay by wire transfer, cryptocurrency or gift card is a warning sign on its own, because such payments are hard to reverse once sent. Legitimate procurement does not need secrecy either, so a request to keep the payment quiet until the award is announced should end the conversation.
04
Fake buyers and orders on credit
Report Fraud describes customer fraud aimed at businesses: criminals use false details or someone else's card, or build trust before placing a large order or asking for a line of credit they never intend to honour. A business that falls for it can lose both the goods and the payment.
The warning signs it lists fit fake tenders closely. Orders larger than usual, repeat purchases of the same item or a burst of rapid orders from a new customer. Requests to sidestep normal payment, invoicing or delivery processes. Little interest in the product, even when it is expensive. Delivery overseas or to an address that differs from the one on record.
For trade customers, Report Fraud suggests checking credit history, reputation and publicly filed records, or asking for independent references, and not proceeding while doubts remain. Ilia Zavialov adds one step for public sector orders: the buyer's opportunity should appear on Contracts Finder or Find a Tender, or the order should be confirmed by the buyer's procurement team on a number found independently.
05
Purchase orders that ship goods to a stranger
Sellers of equipment meet a quieter variant. The fake buyer asks for a quote, accepts it quickly and sends a purchase order with deferred payment terms, so the goods leave the warehouse before any money arrives. The items chosen are the ones that resell easily: laptops, phones, toner, projectors, medical and industrial equipment.
The delivery address is the weak point of the whole scheme. It leads to a storage unit, a freight forwarder, a virtual office or a private home, while the buyer's real premises are somewhere else. The order is urgent, the quantity is large and shipping must be overnight. Questions about the product are few, and the person at the other end rarely picks up the phone.
Ilia Zavialov suggests a fixed check before any goods are reserved: compare the delivery address with the address the buyer publishes, find the procurement officer's number through an independent source and call it, and look at the sender's real domain together with the reply-to address. When the real buyer has never heard of the order, the check has paid for itself.
06
Ilia Zavialov on checking a buyer with Companies House
Companies House data is free on GOV.UK: registered address, date of incorporation, current and resigned officers, previous names and insolvency information. A business can also set up free email alerts about changes such as a new director or address. For a new trade customer this takes minutes and should come before any goods on credit.
The register itself is a target. Companies House says criminals hijack companies by changing director details and registered addresses, and it deals with around 50 to 100 such cases a month. A fake buyer can borrow a real company's name, number and address, so Ilia Zavialov suggests comparing the delivery address and contacts in the order with the company's own published details and calling a number found independently.
Suppliers can protect their own identity from the same abuse. Companies House keeps a page of fake letters sent in its name, and its genuine emails come only from .gov.uk addresses. The free PROOF scheme blocks paper filings that change the registered address, directors or company name, and the company authentication code should be changed when someone who knows it leaves, such as a former employee or accountant.
07
Changed bank details in a live contract, as Zavialov sees it
This scheme attacks a deal that is real. The contract is signed, deliveries are under way, and accounts payable receives a message from the supplier or the client announcing a new bank account. It comes from an address that differs by one letter, or from a genuine mailbox that has been taken over. A signed letter on headed paper is attached to make it feel official.
According to Ilia Zavialov, a change of payment details needs its own route through the company: a call to the counterparty on a number taken from the contract or the original tender notice, approval by a second employee, a check of the new account and only then an update in the payment system. The phone number in the message itself is useless for this check, and so is a reply to the same email thread.
Speed matters once money has left. The sooner the bank hears about the payment, the better the chance of a recall, so the person who spots the problem should know the bank's fraud line and have the authority to call it without waiting for a manager.
08
What the UK figures show
UK Finance counted £41.3 million lost to invoice and mandate scams in 2025 across 2,305 cases. Across all authorised push payment fraud there were 248,070 cases and £576.4 million in losses that year.
Report Fraud defines procurement fraud as any fraud linked to a company buying goods, services or construction work from third parties. Mandate fraud, also called payment diversion fraud or business email compromise, is described as criminals claiming to be from a company the victim already deals with and asking for a payment or a change of bank details, often from look-alike email addresses and with fake invoices.
Ilia Zavialov sees one practical lesson in these definitions: in both cases the decisive moment is a payment or a change of details that nobody verified outside the email thread. That is the moment a written routine is built to catch, and it is the cheapest point at which to stop the loss.
09
Zavialov's routine for accounts payable and the sales desk
Tender scams work at the joins between departments: sales is delighted with the order, accounts pays the deposit, the director signs on the run. A written routine closes those joins. It fits on one page and sits with everyone who handles bids and payments.
Rule one: no payments for participation, registration, credentialing or deposits to accounts named in emails. Rule two: new bank details of any counterparty are confirmed by a call to a known number and by a second employee. Rule three: goods on credit for a new public or corporate buyer ship only after the order has been matched to a published notice or contract and the delivery address has been checked.
Rule four covers logins. Procurement portals are opened from saved bookmarks, never from links in emails, and passwords and payment card details are never typed into a page reached from a message. Ilia Zavialov recommends running a drill from time to time: show the team a fake invitation and see at which step someone stops it.
10
Ilia Zavialov: where to report in the UK
If a payment has been made, tell the bank as soon as possible. The 159 number connects customers of more than 99 percent of UK personal current accounts to their bank and cannot be spoofed. Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040.
Report Fraud's advice on mandate fraud is practical: verify any request to pay a new account using the supplier's official contact details, send a small test payment before a large one and let only designated employees change payment details. It also warns that criminals sometimes return to victims offering to recover the lost money, which is a second scam.
Complaints about trading practices go to Trading Standards through the Citizens Advice consumer service on 0808 223 1133. Ilia Zavialov suggests keeping one folder with the emails and their headers, the order, the delivery address, the invoice and the call log, so the bank, Report Fraud and Trading Standards receive the same account of events.
| Scammer's move | What the official source says | How to check |
|---|---|---|
| Paid access to public tenders | Find a Tender is free to use | Search the portal yourself |
| Tender found only in email | Contracts Finder lists deals over £12,000 | Match the notice to the email |
| Large order on credit | A customer fraud warning sign | Check credit history and records |
| Delivery to another address | Listed by Report Fraud as a signal | Compare with Companies House |
| New bank details by email | The mandate fraud pattern | Official contacts and a test payment |
| Letter from Companies House | Genuine emails come from .gov.uk | Check the sender's domain |
| Offer to recover lost money | A second scam, says Report Fraud | Hang up |
Questions and answers
What does Ilia Zavialov check first when an invitation to tender arrives?
Whether the opportunity is published on the official portal, and whether the buyer's contacts in that notice match the email. If the notice cannot be found, the conversation stops there.
Why does Ilia Zavialov treat a registration or credentialing fee as a scam sign?
Official procurement portals do not sell access, and a fee demanded by email, to a new account and with a short deadline is a classic pressure tactic.
How should a company handle a request to change bank details?
Call the counterparty on a number from the contract, have a second employee approve the change and confirm the new account before the next payment.
Do I have to pay to see UK public tenders?
No. The government says Find a Tender is free to use for everyone, and Contracts Finder can be searched without an account.
How do I check a company that sends a purchase order?
Look it up free on Companies House, compare its registered address and officers with the order and call a number you found independently.
Where do I report a fake tender or mandate fraud in the UK?
Tell your bank at once, using 159 where it works, then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040.